THM Brooklyn Nine Nine Walkthrough

Welcome to my walkthrough of the Brooklyn Nine Nine box from TryHackMe.com. This is my first writeup, so apologies in advance for any mistakes. I will try to keep things spoiler free whilst also showing as much information as possible. So without further delay, lets begin.

First things first, start both the machine and the Attack Box, this takes a few minutes, so I'm going to grab a brew in the meantime. Hacking doesn't work without caffeine (and a black hoodie of course)!

Ok. so coffee is sorted and box is loaded.

Lets begin with an nmap scan, we're not trying to be stealthy here so I use aggressive mode with a full TCP connect and scan all ports. THM are known to hide things on obscure ports so best to check them all even if it does take a little longer.

Scan results are in! We have port 21 running an FTP server, anonymous login is allowed and looks like we have an interesting file called "note_to_****.txt" . We are also running SSH on port 22 and HTTP on port 80.

I'm going to set gobuster running on the webserver, whilst I go and grab that file from the FTP server.

Interesting. We now have three possible usernames and the information that one of them has a weak password! This sounds like a job for THC Hydra. Meanwhile, the Gobuster scan found nothing of use, we can come back to this with a different dictionary later if needed.

Next step is to fire up Hydra and pass it the username we found that has a weak password. I'm going to use rockyou.txt, just for completeness, if it is weak enough it should find it quickly enough!

Ok, so that was crazy fast. We now have a valid username and password for SSH. Let's go ahead and log in, and start digging for files. Nothing in the user's home directory, but if we look in /home then we can see the usernames we gathered from before. Checking them all, one reveals the user flag.

Success! All we need now is root. Let's try some basic privilege escalation with sudo.

Ok, so we can run "less" as sudo with out current user. Checking GTFOBins, we can see that less can be used to run a shell as root. Perfect!

Just like that, we have our root shell and therefore flag.

Thanks to FSociety2006 for a great beginners box, and I hope you found the walkthrough helpful.